Description
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
Published: 2026-08-28
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Credential Disclosure
Action: Immediate Patch
AI Analysis

Impact

The MariaDB Connector for Node.js contains a flaw that removes the secure‑transport requirement for the mysql_clear_password plugin used in PAM dialog authentication. When the connector operates with sslMode=DISABLE and restrictedAuth unset, it can transmit account passwords over plain TCP. A hostile or on‑path server can force this behavior, causing the node application to reveal the database password in cleartext, thereby compromising the confidentiality of credentials.

Affected Systems

MariaDB Corporation’s MariaDB Connector/Node.js is affected. All releases before 3.2.4, 3.3.3, 3.4.6, and 3.5.3 are vulnerable.

Risk and Exploitability

With a CVSS score of 5.9 the vulnerability is moderate. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog. The likely attack path involves an application that connects to the database without TLS (sslMode=DISABLE) and with restrictedAuth unset; a network adversary or malicious server can send a switch request to trigger cleartext transmission. While the flaw does not provide code execution, exposed passwords can lead to further compromise if reused elsewhere.

Generated by OpenCVE AI on August 28, 2026 at 23:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to MariaDB Connector/Node.js version 3.2.4 or later.
  • Configure the connector to use TLS by setting sslMode to VERIFY_CA or VERIFY_IDENTITY and ensuring proper certificate validation.
  • Avoid using the default sslMode=DISABLE and restrictedAuth=null; use a local Unix socket for authentication when possible.

Generated by OpenCVE AI on August 28, 2026 at 23:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-42r5-vhpq-m858 MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
History

Mon, 31 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Mariadb
Mariadb connector-nodejs
Vendors & Products Mariadb
Mariadb connector-nodejs

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Description MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
Title MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb
Weaknesses CWE-319
CWE-522
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Mariadb Connector-nodejs
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-31T18:53:32.987Z

Reserved: 2026-06-17T16:44:40.995Z

Link: CVE-2026-55854

cve-icon Vulnrichment

Updated: 2026-08-31T15:21:08.569Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-28T23:17:08.203

Modified: 2026-09-08T21:08:37.320

Link: CVE-2026-55854

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:24:31Z

Weaknesses
  • CWE-319

    Cleartext Transmission of Sensitive Information

  • CWE-522

    Insufficiently Protected Credentials